Knowledge on AI, data protection and security.

Practical answers for companies in Germany, Austria and Switzerland – from the GDPR to your AI policy.

Data protection26 July 20264 min read

AI and data protection in Switzerland: what companies need to know

AI tools process personal data – which brings them under the revFADP. The legal position, the typical mistakes and a checklist for adopting AI in line with data protection law.

Data protection26 July 20264 min read

The revFADP explained: Switzerland's revised data protection act

The revised Federal Act on Data Protection has applied since 1 September 2023, with no transition period. The key duties, the fines regime – and what the revFADP means for AI.

Practice26 July 20263 min read

ChatGPT at work: risks, rules and secure alternatives

ChatGPT has arrived in everyday work – often through private accounts. What happens to the inputs, where the risks lie and what companies should look for in an alternative.

Security26 July 20263 min read

Shadow AI: spotting and fixing uncontrolled AI use

When employees use private AI accounts for work, shadow AI emerges. Why bans make the problem worse and what the controlled route looks like.

Compliance26 July 20264 min read

Professional secrecy and AI: what law firms, practices and tax advisers need to know

Lawyers, doctors and other professions are bound by a criminally enforced duty of secrecy. What that means for AI tools – and the conditions under which their use is permissible.

Practice26 July 20263 min read

Writing an AI policy: a guide for companies, with checklist

Without rules you get sprawl; with rules that are too strict you get shadow AI. What a workable AI policy looks like and how to roll it out successfully.

Compliance26 July 20263 min read

The EU AI Act: what it means for companies in the DACH region

The EU regulates AI by risk. In Germany and Austria the AI Act applies directly; Swiss companies are caught by the marketplace principle. The risk classes, the timetable and the right first steps.

Security26 July 20263 min read

Data sovereignty: why the location of your data decides

Where data is processed determines whose law applies and who can compel access. What data sovereignty means and what to look for in European hosting.

Security26 July 20263 min read

LLM security: the risks of language models and how companies control them

Language models bring new classes of attack and error. An overview of the relevant risks – from prompt injection to data leakage – and the countermeasures.

Compliance26 July 20263 min read

AI at banks and insurers: what the regulators expect

Regulators expect supervised institutions to deploy AI under control – in Germany, Austria and Switzerland alike. What that means in practice, from governance to outsourcing.

Practice26 July 20263 min read

Adopting AI in an SME: the roadmap for the first 90 days

Between isolated experiments and a major project lies the pragmatic route: a structured rollout in three phases. The roadmap for the first 90 days.